Linux CXL
 help / color / mirror / Atom feed
From: Ira Weiny <ira.weiny@intel.com>
To: Dan Williams <dan.j.williams@intel.com>, <nvdimm@lists.linux.dev>
Cc: Yongqiang Liu <liuyongqiang13@huawei.com>,
	Paul Cassella <cassella@hpe.com>, Ira Weiny <ira.weiny@intel.com>,
	<linux-cxl@vger.kernel.org>
Subject: Re: [PATCH 3/4] dax: Introduce alloc_dev_dax_id()
Date: Sat, 3 Jun 2023 19:57:02 -0700	[thread overview]
Message-ID: <647bfd7e1ef3_4c9842941c@iweiny-mobl.notmuch> (raw)
In-Reply-To: <168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com>

Dan Williams wrote:
> The reference counting of dax_region objects is needlessly complicated,
> has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up
> that mess introduce alloc_dev_dax_id() to minimize the holding of a
> dax_region reference to only what dev_dax_release() needs, the
> dax_region->ida.
> 
> Part of the reason for the mess was the design to dereference a
> dax_region in all cases in free_dev_dax_id() even if the id was
> statically assigned by the upper level dax_region driver. Remove the
> need to call "is_static(dax_region)" by tracking whether the id is
> dynamic directly in the dev_dax instance itself.
> 
> With that flag the dax_region pinning and release per dev_dax instance
> can move to alloc_dev_dax_id() and free_dev_dax_id() respectively.
> 
> A follow-on cleanup address the unnecessary references in the dax_region
> setup and drivers.
> 
> Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices")
> Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1]
> Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2]
> Reported-by: Yongqiang Liu <liuyongqiang13@huawei.com>
> Reported-by: Paul Cassella <cassella@hpe.com>
> Reported-by: Ira Weiny <ira.weiny@intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
>  drivers/dax/bus.c         |   56 +++++++++++++++++++++++++++------------------
>  drivers/dax/dax-private.h |    4 ++-
>  2 files changed, 37 insertions(+), 23 deletions(-)
> 
> diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
> index c99ea08aafc3..a4cc3eca774f 100644
> --- a/drivers/dax/bus.c
> +++ b/drivers/dax/bus.c
> @@ -446,18 +446,34 @@ static void unregister_dev_dax(void *dev)
>  	put_device(dev);
>  }
>  
> +static void dax_region_free(struct kref *kref)
> +{
> +	struct dax_region *dax_region;
> +
> +	dax_region = container_of(kref, struct dax_region, kref);
> +	kfree(dax_region);
> +}
> +
> +void dax_region_put(struct dax_region *dax_region)
> +{
> +	kref_put(&dax_region->kref, dax_region_free);
> +}
> +EXPORT_SYMBOL_GPL(dax_region_put);
> +
>  /* a return value >= 0 indicates this invocation invalidated the id */
>  static int __free_dev_dax_id(struct dev_dax *dev_dax)
>  {
> -	struct dax_region *dax_region = dev_dax->region;
>  	struct device *dev = &dev_dax->dev;
> +	struct dax_region *dax_region;
>  	int rc = dev_dax->id;
>  
>  	device_lock_assert(dev);
>  
> -	if (is_static(dax_region) || dev_dax->id < 0)
> +	if (!dev_dax->dyn_id || dev_dax->id < 0)
>  		return -1;
> +	dax_region = dev_dax->region;
>  	ida_free(&dax_region->ida, dev_dax->id);
> +	dax_region_put(dax_region);
>  	dev_dax->id = -1;
>  	return rc;
>  }
> @@ -473,6 +489,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax)
>  	return rc;
>  }
>  
> +static int alloc_dev_dax_id(struct dev_dax *dev_dax)
> +{
> +	struct dax_region *dax_region = dev_dax->region;
> +	int id;
> +
> +	id = ida_alloc(&dax_region->ida, GFP_KERNEL);
> +	if (id < 0)
> +		return id;
> +	kref_get(&dax_region->kref);
> +	dev_dax->dyn_id = true;
> +	dev_dax->id = id;
> +	return id;
> +}
> +
>  static ssize_t delete_store(struct device *dev, struct device_attribute *attr,
>  		const char *buf, size_t len)
>  {
> @@ -560,20 +590,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = {
>  	NULL,
>  };
>  
> -static void dax_region_free(struct kref *kref)
> -{
> -	struct dax_region *dax_region;
> -
> -	dax_region = container_of(kref, struct dax_region, kref);
> -	kfree(dax_region);
> -}
> -
> -void dax_region_put(struct dax_region *dax_region)
> -{
> -	kref_put(&dax_region->kref, dax_region_free);
> -}
> -EXPORT_SYMBOL_GPL(dax_region_put);
> -
>  static void dax_region_unregister(void *region)
>  {
>  	struct dax_region *dax_region = region;
> @@ -1297,12 +1313,10 @@ static const struct attribute_group *dax_attribute_groups[] = {
>  static void dev_dax_release(struct device *dev)
>  {
>  	struct dev_dax *dev_dax = to_dev_dax(dev);
> -	struct dax_region *dax_region = dev_dax->region;
>  	struct dax_device *dax_dev = dev_dax->dax_dev;
>  
>  	put_dax(dax_dev);
>  	free_dev_dax_id(dev_dax);
> -	dax_region_put(dax_region);
>  	kfree(dev_dax->pgmap);
>  	kfree(dev_dax);
>  }
> @@ -1326,6 +1340,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
>  	if (!dev_dax)
>  		return ERR_PTR(-ENOMEM);
>  
> +	dev_dax->region = dax_region;

Overall I like that this reference is not needed to be carried and/or
managed by the callers.

However, here you are referencing the dax_region from the dev_dax in an
unrelated place to where the reference matters (in id management).

Could alloc_dev_dax_id() change to:

static int alloc_dev_dax_id(struct dev_dax *dev_dax, struct dax_region *dax_region)
{
...
}

Then make this assignment next to where the kref is taken so it is clear
that this is the only user of the reference?

I did not pick up on the fact this reference was only needed to free the
id at all in reviewing the code and I think this would make it even more
clear.

Ira

>  	if (is_static(dax_region)) {
>  		if (dev_WARN_ONCE(parent, data->id < 0,
>  				"dynamic id specified to static region\n")) {
> @@ -1341,13 +1356,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
>  			goto err_id;
>  		}
>  
> -		rc = ida_alloc(&dax_region->ida, GFP_KERNEL);
> +		rc = alloc_dev_dax_id(dev_dax);
>  		if (rc < 0)
>  			goto err_id;
> -		dev_dax->id = rc;
>  	}
>  
> -	dev_dax->region = dax_region;
>  	dev = &dev_dax->dev;
>  	device_initialize(dev);
>  	dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id);
> @@ -1388,7 +1401,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
>  	dev_dax->target_node = dax_region->target_node;
>  	dev_dax->align = dax_region->align;
>  	ida_init(&dev_dax->ida);
> -	kref_get(&dax_region->kref);
>  
>  	inode = dax_inode(dax_dev);
>  	dev->devt = inode->i_rdev;
> diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
> index 1c974b7caae6..afcada6fd2ed 100644
> --- a/drivers/dax/dax-private.h
> +++ b/drivers/dax/dax-private.h
> @@ -52,7 +52,8 @@ struct dax_mapping {
>   * @region - parent region
>   * @dax_dev - core dax functionality
>   * @target_node: effective numa node if dev_dax memory range is onlined
> - * @id: ida allocated id
> + * @dyn_id: is this a dynamic or statically created instance
> + * @id: ida allocated id when the dax_region is not static
>   * @ida: mapping id allocator
>   * @dev - device core
>   * @pgmap - pgmap for memmap setup / lifetime (driver owned)
> @@ -64,6 +65,7 @@ struct dev_dax {
>  	struct dax_device *dax_dev;
>  	unsigned int align;
>  	int target_node;
> +	bool dyn_id;
>  	int id;
>  	struct ida ida;
>  	struct device dev;
> 

  reply	other threads:[~2023-06-04  2:57 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-03  6:13 [PATCH 0/4] dax: Fix use after free and other cleanups Dan Williams
2023-06-03  6:13 ` [PATCH 1/4] dax: Fix dax_mapping_release() use after free Dan Williams
2023-06-04  2:40   ` Ira Weiny
2023-06-05 20:45   ` Fan Ni
2023-06-15 17:33   ` Dave Jiang
2023-06-03  6:13 ` [PATCH 2/4] dax: Use device_unregister() in unregister_dax_mapping() Dan Williams
2023-06-04  2:41   ` Ira Weiny
2023-06-05 20:46   ` Fan Ni
2023-06-15 17:34   ` Dave Jiang
2023-06-03  6:14 ` [PATCH 3/4] dax: Introduce alloc_dev_dax_id() Dan Williams
2023-06-04  2:57   ` Ira Weiny [this message]
2023-06-16  1:22     ` Dan Williams
2023-06-16 22:11       ` Ira Weiny
2023-06-03  6:14 ` [PATCH 4/4] dax: Cleanup extra dax_region references Dan Williams
2023-06-04  2:58   ` Ira Weiny
2023-06-06 17:46   ` Fan Ni
2023-06-06 20:42     ` Ira Weiny
2023-06-15 17:45   ` Dave Jiang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=647bfd7e1ef3_4c9842941c@iweiny-mobl.notmuch \
    --to=ira.weiny@intel.com \
    --cc=cassella@hpe.com \
    --cc=dan.j.williams@intel.com \
    --cc=linux-cxl@vger.kernel.org \
    --cc=liuyongqiang13@huawei.com \
    --cc=nvdimm@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox